LM Studio: LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's…
LM Studio
More for LM Studio RSS feed for LM Studio
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-119979
- Affects
- LM Studio
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- October 30, 2026
- Source last modified
- October 30, 2026
Description
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
Description quoted from the NVD record.